Technical impact
This CSRF flaw permits an attacker to force authenticated users to perform unwanted actions within the plugin. Through forged requests, an attacker could alter pricing tables, disable discounts, or otherwise manipulate the plugin’s settings, affecting the integrity and business logic of the WooCommerce store. The weakness is classified as CWE‑352 and the CVSS score of 5.4 indicates moderate severity.
Affected Systems
The vulnerability exists in RedefiningTheWeb’s Dynamic Pricing & Discounts Lite for WooCommerce plugin from its initial public release through version 2.0.4. Any WordPress site running this plugin with a version up to and including 2.0.4 is susceptible. The issue does not affect earlier versions that are not exposed by the plugin’s current configuration paths.
Risk and Exploitability
The CVSS score of 5.4 reflects moderate impact, and the EPSS score of less than 1% indicates a very low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely leveraged. Likely attack vectors involve a malicious site or email that directs an authenticated admin to a crafted URL that triggers a CSRF action, taking advantage of the plugin’s lack of CSRF tokens or proper state validation.
EUVD